Dear Gioele,
I am currently on a mission to get sssd back into Debian testing,
currently blocked by:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522
The proposed fix for the above issue involves sudo becoming the
"owner" of the sudoers: entry in nsswitch.conf:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147179
The proposed fix in above bug report (adding debian/sudo.nss with
below content) does fail when upgrading sudo from a version of the
sudo package that did not have debian/sudo.nss, yet:
```
sudoers database-add
sudoers first files
```
When installing sudo a-fresh, with above sudo.nss file, "sudoers:
files" appears at the end of nsswitch.conf (GOOD). However, when
upgrading from an earlier version of the sudo package, we get
"sudoers:" in nsswitch.conf (BOOM). So, we end up in a broken state.
The fix for this needs to be applied to dh-nss, I guess:
```
diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss
dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16
16:05:08.000000000 +0200
@@ -1,4 +1,4 @@
-if [ "$1" = install ]; then
+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E
#SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then
# Signal to postinst that the NSS services should be installed,
even if the package has been removed but not purged.
touch
"${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+ upgrade, too. (Closes: -1).
+ - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+ from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+ been applied, yet.
+ - Assure SERVICE_PATTERN macro gets populated properly during preinst
+ autoscript generation.
+
+ -- Mike Gabriel <sunweaver@debian.org> Wed, 16 Sep 2026 16:05:25 +0200
+
dh-nss (1.7.1) unstable; urgency=medium
* t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
my $service_patterns_expr = service_patterns_expr(\%db_services);
# Add a snippet in preinst to detect installation of non-purged packages.
- autoscript($package, "preinst", "preinst-nss");
+ autoscript($package, "preinst", "preinst-nss", {
+ "SERVICE_PATTERNS" => $service_patterns_expr,
+ });
# Generate one snippet for each extra NSS databases to be added.
foreach my $db_extra (@dbs_extra_add) {
```
Same .debdiff is attached. Please let us know if you see this as a
possible fix and if you can provide this change anytime soon.
Thanks,
Mike (and Marc, maintainer of sudo)